@shipfox/api-workflows 4.0.0 → 6.0.0

package/src/presentation/routes/checkout-token.ts

@@ -1,7 +1,12 @@
 import {requireLeasedJobContext} from '@shipfox/api-auth-context';
-import {integrationRouteErrorHandler} from '@shipfox/api-integration-core';
-import {isJobLeaseActive} from '@shipfox/api-runners';
+import {
+  type IntegrationsModuleClient,
+  integrationsInterModuleContract,
+} from '@shipfox/api-integration-core-dto';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
+import type {RunnersInterModuleClient} from '@shipfox/api-runners-dto/inter-module';
 import {checkoutTokenResponseSchema} from '@shipfox/api-workflows-dto';
+import {isInterModuleKnownError} from '@shipfox/inter-module';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {createJobCheckoutSpec} from '#core/checkout.js';
 import {
@@ -9,53 +14,108 @@ import {
   JobNotFoundError,
   WorkflowRunNotFoundError,
 } from '#core/errors.js';
-import {sourceControl} from '#core/source-control.js';
 import {toCheckoutTokenDto} from '#presentation/dto/checkout-token.js';
 
-export const checkoutTokenRoute = defineRoute({
-  method: 'POST',
-  path: '/checkout-token',
-  description:
-    "Exchanges the runner's job lease for short-lived, read-only checkout credentials for the job's repository. The job is identified by the access token, so no job ID is needed. The checkout target is resolved server-side from the job's run and project; no credential material is stored on the job or run. Returns the repository URL, ref, and (when the provider needs auth) a short-lived credential that expires soon.",
-  schema: {
-    response: {
-      200: checkoutTokenResponseSchema,
+export function createCheckoutTokenRoute(clients: {
+  runners: RunnersInterModuleClient;
+  integrations: IntegrationsModuleClient;
+  projects: ProjectsModuleClient;
+}) {
+  return defineRoute({
+    method: 'POST',
+    path: '/checkout-token',
+    description:
+      "Exchanges the runner's job lease for short-lived, read-only checkout credentials for the job's repository. The job is identified by the access token, so no job ID is needed. The checkout target is resolved server-side from the job's run and project; no credential material is stored on the job or run. Returns the repository URL, ref, and (when the provider needs auth) a short-lived credential that expires soon.",
+    schema: {response: {200: checkoutTokenResponseSchema}},
+    errorHandler: (error) => {
+      const known = isInterModuleKnownError(
+        integrationsInterModuleContract.methods.createCheckoutSpec,
+        error,
+      )
+        ? error
+        : undefined;
+      if (error instanceof JobNotFoundError)
+        throw new ClientError(error.message, 'job-not-found', {status: 404});
+      if (error instanceof WorkflowRunNotFoundError)
+        throw new ClientError(error.message, 'run-not-found', {status: 404});
+      if (error instanceof CheckoutIntentUnresolvedError)
+        throw new ClientError(error.message, 'checkout-unavailable', {status: 404});
+      if (known?.code === 'connection-not-found')
+        throw new ClientError(
+          'Integration connection not found',
+          'integration-connection-not-found',
+          {
+            status: 404,
+          },
+        );
+      if (known?.code === 'connection-inactive')
+        throw new ClientError(
+          'Integration connection is not active',
+          'integration-connection-inactive',
+          {
+            status: 422,
+          },
+        );
+      if (known?.code === 'connection-workspace-mismatch')
+        throw new ClientError(
+          'Integration connection does not belong to this workspace',
+          'forbidden',
+          {status: 403},
+        );
+      if (known?.code === 'provider-unavailable')
+        throw new ClientError(
+          'Integration provider is unavailable',
+          'integration-provider-unavailable',
+          {
+            status: 422,
+          },
+        );
+      if (known?.code === 'capability-unavailable')
+        throw new ClientError(
+          'Integration capability is unavailable',
+          'integration-capability-unavailable',
+          {
+            status: 422,
+          },
+        );
+      if (known?.code === 'checkout-unsupported')
+        throw new ClientError(
+          'Integration checkout is unsupported',
+          'integration-checkout-unsupported',
+          {
+            status: 422,
+          },
+        );
+      if (known?.code === 'provider-failure') {
+        const status =
+          known.details.reason === 'rate-limited'
+            ? 429
+            : known.details.reason === 'timeout' || known.details.reason === 'provider-unavailable'
+              ? 503
+              : 422;
+        throw new ClientError('Integration provider request failed', known.details.reason, {
+          details: {retry_after_seconds: known.details.retryAfterSeconds},
+          status,
+        });
+      }
+      throw error;
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof JobNotFoundError) {
-      throw new ClientError(error.message, 'job-not-found', {status: 404});
-    }
-    if (error instanceof WorkflowRunNotFoundError) {
-      throw new ClientError(error.message, 'run-not-found', {status: 404});
-    }
-    if (error instanceof CheckoutIntentUnresolvedError) {
-      throw new ClientError(error.message, 'checkout-unavailable', {status: 404});
-    }
-    // Connection and provider errors (and the structural provider-error detection)
-    // map through the shared handler, which re-throws unknowns to the global handler.
-    return integrationRouteErrorHandler(error);
-  },
-  handler: async (request, reply) => {
-    const leasedJob = requireLeasedJobContext(request);
-
-    const leaseIsActive = await isJobLeaseActive({
-      jobId: leasedJob.jobId,
-      jobExecutionId: leasedJob.jobExecutionId,
-      runnerSessionId: leasedJob.runnerSessionId,
-    });
-    if (!leaseIsActive) {
-      throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
-    }
-
-    const checkout = await createJobCheckoutSpec({
-      jobId: leasedJob.jobId,
-      sourceControl: sourceControl(),
-    });
-
-    // The body carries short-lived git credentials; forbid any intermediary or
-    // client cache from retaining them.
-    reply.header('cache-control', 'no-store');
-    return toCheckoutTokenDto(checkout.spec, {persist: checkout.persistCredentials});
-  },
-});
+    handler: async (request, reply) => {
+      const leasedJob = requireLeasedJobContext(request);
+      const {active: leaseIsActive} = await clients.runners.getLeaseState({
+        jobId: leasedJob.jobId,
+        jobExecutionId: leasedJob.jobExecutionId,
+        runnerSessionId: leasedJob.runnerSessionId,
+      });
+      if (!leaseIsActive)
+        throw new ClientError('Job lease is no longer active', 'lease-not-active', {status: 404});
+      const checkout = await createJobCheckoutSpec({
+        jobId: leasedJob.jobId,
+        integrations: clients.integrations,
+        projects: clients.projects,
+      });
+      reply.header('cache-control', 'no-store');
+      return toCheckoutTokenDto(checkout.spec, {persist: checkout.persistCredentials});
+    },
+  });
+}

package/src/presentation/routes/get-run-aggregates.test.ts

@@ -1,4 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import type {FastifyInstance} from 'fastify';
 import Fastify from 'fastify';
 import {serializerCompiler, validatorCompiler} from 'fastify-type-provider-zod';
@@ -8,15 +9,20 @@ import {getRunAggregatesRoute} from './get-run-aggregates.js';
 
 const projectAccessState = vi.hoisted(() => ({workspaceId: ''}));
 
-vi.mock('@shipfox/api-projects', () => ({
-  ProjectNotFoundError: class ProjectNotFoundError extends Error {},
-  requireProjectAccess: vi.fn(({projectId}) =>
+const projects = {
+  getProjectById: vi.fn(({projectId}) =>
     Promise.resolve({
-      project: {id: projectId, workspaceId: projectAccessState.workspaceId},
-      workspaceId: projectAccessState.workspaceId,
+      project: {
+        id: projectId,
+        workspaceId: projectAccessState.workspaceId,
+        sourceConnectionId: crypto.randomUUID(),
+        sourceExternalRepositoryId: 'repo',
+        name: 'Project',
+      },
     }),
   ),
-}));
+  requireProjectForWorkspace: vi.fn(),
+} as unknown as ProjectsModuleClient;
 
 describe('GET /api/workflows/runs/aggregates', () => {
   let app: FastifyInstance;
@@ -38,7 +44,7 @@ describe('GET /api/workflows/runs/aggregates', () => {
       );
       done();
     });
-    app.get('/api/workflows/runs/aggregates', getRunAggregatesRoute);
+    app.get('/api/workflows/runs/aggregates', getRunAggregatesRoute(projects));
     await app.ready();
   });
 

package/src/presentation/routes/get-run-aggregates.ts

@@ -1,69 +1,66 @@
-import {ProjectNotFoundError, requireProjectAccess} from '@shipfox/api-projects';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {
   workflowRunAggregatesQuerySchema,
   workflowRunAggregatesResponseSchema,
 } from '@shipfox/api-workflows-dto';
-import {ClientError, defineRoute} from '@shipfox/node-fastify';
+import {defineRoute} from '@shipfox/node-fastify';
 import {logger} from '@shipfox/node-opentelemetry';
 import {getWorkflowRunAggregates} from '#db/index.js';
+import {requireProjectAccess} from './project-access.js';
 
-export const getRunAggregatesRoute = defineRoute({
-  method: 'GET',
-  path: '/aggregates',
-  description: 'Get faceted workflow run counts for a project',
-  schema: {
-    querystring: workflowRunAggregatesQuerySchema,
-    response: {
-      200: workflowRunAggregatesResponseSchema,
+export function getRunAggregatesRoute(projects: ProjectsModuleClient) {
+  return defineRoute({
+    method: 'GET',
+    path: '/aggregates',
+    description: 'Get faceted workflow run counts for a project',
+    schema: {
+      querystring: workflowRunAggregatesQuerySchema,
+      response: {
+        200: workflowRunAggregatesResponseSchema,
+      },
     },
-  },
-  errorHandler: (error) => {
-    if (error instanceof ProjectNotFoundError) {
-      throw new ClientError(error.message, 'project-not-found', {status: 404});
-    }
-    throw error;
-  },
-  handler: async (request) => {
-    const startedAt = performance.now();
-    const {
-      project_id: projectId,
-      status,
-      definition_id: definitionId,
-      trigger_source: triggerSource,
-      created_from: createdFrom,
-      created_to: createdTo,
-    } = request.query;
+    handler: async (request) => {
+      const startedAt = performance.now();
+      const {
+        project_id: projectId,
+        status,
+        definition_id: definitionId,
+        trigger_source: triggerSource,
+        created_from: createdFrom,
+        created_to: createdTo,
+      } = request.query;
 
-    const {project} = await requireProjectAccess({request, projectId});
-    const filters = {
-      status,
-      definitionId,
-      triggerSource,
-      createdFrom: createdFrom ? new Date(createdFrom) : undefined,
-      createdTo: createdTo ? new Date(createdTo) : undefined,
-    };
-    const aggregates = await getWorkflowRunAggregates({projectId: project.id, filters});
+      const project = await requireProjectAccess(request, projectId, projects);
+      const filters = {
+        status,
+        definitionId,
+        triggerSource,
+        createdFrom: createdFrom ? new Date(createdFrom) : undefined,
+        createdTo: createdTo ? new Date(createdTo) : undefined,
+      };
+      const aggregates = await getWorkflowRunAggregates({projectId: project.id, filters});
 
-    logger().info(
-      {
-        projectId: project.id,
-        filterKeys: Object.entries(filters)
-          .filter(([, value]) => value !== undefined)
-          .map(([key]) => key),
-        aggregateBucketSizes: {
-          status: aggregates.status.length,
-          triggerSource: aggregates.triggerSource.length,
-          workflow: aggregates.workflow.length,
+      logger().info(
+        {
+          projectId: project.id,
+          filterKeys: Object.entries(filters)
+            .filter(([, value]) => value !== undefined)
+            .map(([key]) => key),
+          aggregateBucketSizes: {
+            status: aggregates.status.length,
+            triggerSource: aggregates.triggerSource.length,
+            workflow: aggregates.workflow.length,
+          },
+          durationMs: Math.round(performance.now() - startedAt),
         },
-        durationMs: Math.round(performance.now() - startedAt),
-      },
-      'Aggregated workflow runs',
-    );
+        'Aggregated workflow runs',
+      );
 
-    return {
-      status: aggregates.status,
-      trigger_source: aggregates.triggerSource,
-      workflow: aggregates.workflow,
-    };
-  },
-});
+      return {
+        status: aggregates.status,
+        trigger_source: aggregates.triggerSource,
+        workflow: aggregates.workflow,
+      };
+    },
+  });
+}

package/src/presentation/routes/get-run.test.ts

@@ -1,5 +1,5 @@
 import {buildUserContext, setUserContext} from '@shipfox/api-auth-context';
-import {requireProjectAccess} from '@shipfox/api-projects';
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {ClientError} from '@shipfox/node-fastify';
 import {eq} from 'drizzle-orm';
 import type {FastifyInstance} from 'fastify';
@@ -40,16 +40,11 @@ async function recordStepResult(
   return recordJobExecutionStepResult({...rest, jobExecutionId: step.jobExecutionId});
 }
 
-vi.mock('@shipfox/api-projects', () => ({
-  requireProjectAccess: vi.fn(({projectId}) =>
-    Promise.resolve({
-      project: {id: projectId, workspaceId: projectAccessState.workspaceId},
-      workspaceId: projectAccessState.workspaceId,
-    }),
-  ),
-}));
-
-const mockRequireProjectAccess = vi.mocked(requireProjectAccess);
+const getProjectById = vi.fn();
+const projects = {
+  getProjectById,
+  requireProjectForWorkspace: vi.fn(),
+} as unknown as ProjectsModuleClient;
 
 describe('GET /api/workflows/runs/:id', () => {
   let app: FastifyInstance;
@@ -70,14 +65,14 @@ describe('GET /api/workflows/runs/:id', () => {
       );
       done();
     });
-    app.get('/api/workflows/runs/:id', getRunRoute);
+    app.get('/api/workflows/runs/:id', getRunRoute(projects));
     await app.ready();
   });
 
   beforeEach(() => {
     workspaceId = crypto.randomUUID();
     projectAccessState.workspaceId = workspaceId;
-    mockRequireProjectAccess.mockImplementation(({projectId}) =>
+    getProjectById.mockImplementation(({projectId}) =>
       Promise.resolve({
         project: {
           id: projectId,
@@ -85,10 +80,7 @@ describe('GET /api/workflows/runs/:id', () => {
           sourceConnectionId: crypto.randomUUID(),
           sourceExternalRepositoryId: `repo:${crypto.randomUUID()}`,
           name: 'Project',
-          createdAt: new Date(),
-          updatedAt: new Date(),
         },
-        workspaceId,
       }),
     );
   });
@@ -362,7 +354,7 @@ jobs:
         userId: crypto.randomUUID(),
       },
     });
-    mockRequireProjectAccess.mockRejectedValueOnce(
+    getProjectById.mockRejectedValueOnce(
       new ClientError('Not a member of this workspace', 'forbidden', {status: 403}),
     );
 
@@ -389,7 +381,7 @@ jobs:
         userId: crypto.randomUUID(),
       },
     });
-    mockRequireProjectAccess.mockRejectedValueOnce(new Error('database connection lost'));
+    getProjectById.mockRejectedValueOnce(new Error('database connection lost'));
 
     const res = await app.inject({
       method: 'GET',

package/src/presentation/routes/get-run.ts

@@ -1,3 +1,4 @@
+import type {ProjectsModuleClient} from '@shipfox/api-projects-dto';
 import {workflowRunDetailResponseSchema} from '@shipfox/api-workflows-dto';
 import {ClientError, defineRoute} from '@shipfox/node-fastify';
 import {z} from 'zod';
@@ -12,55 +13,57 @@ import {
 } from '#presentation/dto/index.js';
 import {requireAccessibleRun} from './require-accessible-run.js';
 
-export const getRunRoute = defineRoute({
-  method: 'GET',
-  path: '/:id',
-  description: 'Get a workflow run by ID with jobs and steps',
-  schema: {
-    params: z.object({
-      id: z.string().uuid(),
-    }),
-    querystring: z.object({
-      attempt: z.coerce.number().int().positive().optional(),
-    }),
-    response: {
-      200: workflowRunDetailResponseSchema,
+export function getRunRoute(projects: ProjectsModuleClient) {
+  return defineRoute({
+    method: 'GET',
+    path: '/:id',
+    description: 'Get a workflow run by ID with jobs and steps',
+    schema: {
+      params: z.object({
+        id: z.string().uuid(),
+      }),
+      querystring: z.object({
+        attempt: z.coerce.number().int().positive().optional(),
+      }),
+      response: {
+        200: workflowRunDetailResponseSchema,
+      },
     },
-  },
-  handler: async (request) => {
-    const {id} = request.params;
-    await requireAccessibleRun({request, id});
+    handler: async (request) => {
+      const {id} = request.params;
+      await requireAccessibleRun({request, id, projects});
 
-    const run = await getWorkflowRunDetail(id, request.query.attempt);
-    if (!run) {
-      throw new ClientError('Run not found', 'not-found', {status: 404});
-    }
+      const run = await getWorkflowRunDetail(id, request.query.attempt);
+      if (!run) {
+        throw new ClientError('Run not found', 'not-found', {status: 404});
+      }
 
-    const jobDtos = run.jobs.map((job) => ({
-      ...toJobDto(job),
-      job_executions: job.jobExecutions.map((jobExecution) => ({
-        ...toJobExecutionDto(jobExecution),
-        steps: jobExecution.steps.map((step) => {
-          const attempts = step.attempts.map(toStepAttemptDto);
-          const latestTerminalAttempt = attempts
-            .filter((attempt) => attempt.status !== 'running')
-            .at(-1);
-          return {
-            ...toStepDto(step),
-            exit_code: latestTerminalAttempt?.exit_code ?? null,
-            outputs: latestTerminalAttempt?.outputs ?? null,
-            response: latestTerminalAttempt?.response ?? null,
-            gate_result: latestTerminalAttempt?.gate_result ?? null,
-            attempts,
-          };
-        }),
-      })),
-    }));
+      const jobDtos = run.jobs.map((job) => ({
+        ...toJobDto(job),
+        job_executions: job.jobExecutions.map((jobExecution) => ({
+          ...toJobExecutionDto(jobExecution),
+          steps: jobExecution.steps.map((step) => {
+            const attempts = step.attempts.map(toStepAttemptDto);
+            const latestTerminalAttempt = attempts
+              .filter((attempt) => attempt.status !== 'running')
+              .at(-1);
+            return {
+              ...toStepDto(step),
+              exit_code: latestTerminalAttempt?.exit_code ?? null,
+              outputs: latestTerminalAttempt?.outputs ?? null,
+              response: latestTerminalAttempt?.response ?? null,
+              gate_result: latestTerminalAttempt?.gate_result ?? null,
+              attempts,
+            };
+          }),
+        })),
+      }));
 
-    return {
-      ...toRunDto(run, run.latestAttempt),
-      run_attempt: toRunAttemptDto(run.runAttempt),
-      jobs: jobDtos,
-    };
-  },
-});
+      return {
+        ...toRunDto(run, run.latestAttempt),
+        run_attempt: toRunAttemptDto(run.runAttempt),
+        jobs: jobDtos,
+      };
+    },
+  });
+}

package/src/presentation/routes/get-step-secrets.test.ts

@@ -1,5 +1,4 @@
 import {createLeaseTokenAuthMethod} from '@shipfox/api-auth';
-import {setSecrets} from '@shipfox/api-secrets';
 import {closeApp, createApp, type FastifyInstance} from '@shipfox/node-fastify';
 import {createCapturingLogger} from '@shipfox/node-log/test';
 import {eq} from 'drizzle-orm';
@@ -15,18 +14,35 @@ import {
 } from '#db/workflow-runs.js';
 import {workflowModel} from '#test/factories/workflow-model.js';
 import {mintActiveLeaseToken} from '#test/fixtures/active-lease-token.js';
-import {leaseTokenRouteGroup} from './index.js';
+import {agentTestClient} from '#test/fixtures/agent-inter-module.js';
+import {annotationsTestClient} from '#test/fixtures/annotations-inter-module.js';
+import {workflowsTestAuthClient} from '#test/fixtures/auth-inter-module.js';
+import {projectsTestClient} from '#test/fixtures/projects-inter-module.js';
+import {runnersTestClient} from '#test/fixtures/runners-inter-module.js';
+import {createTestSecretsClient} from '#test/fixtures/secrets-inter-module.js';
+import {createLeaseTokenRouteGroup} from './index.js';
 
 const URL_PREFIX = '/runs/jobs/current/steps';
 
 describe('GET /runs/jobs/current/steps/:stepId/secrets', () => {
   let app: FastifyInstance;
+  const secrets = createTestSecretsClient();
   const {logger, lines: logLines, clear: clearLogLines} = createCapturingLogger();
 
   beforeAll(async () => {
     app = await createApp({
       auth: [createLeaseTokenAuthMethod()],
-      routes: [leaseTokenRouteGroup],
+      routes: [
+        createLeaseTokenRouteGroup({
+          agent: agentTestClient,
+          annotations: annotationsTestClient,
+          auth: workflowsTestAuthClient,
+          integrations: {} as never,
+          projects: projectsTestClient,
+          runners: runnersTestClient,
+          secrets,
+        }),
+      ],
       swagger: false,
       fastifyOptions: {loggerInstance: logger},
     });
@@ -56,7 +72,7 @@ describe('GET /runs/jobs/current/steps/:stepId/secrets', () => {
         segments: [{kind: 'secret', store: 'local', key: 'API_TOKEN'}],
       },
     ]);
-    await setSecrets({
+    await secrets.setSecrets({
       workspaceId: run.workspaceId,
       projectId: run.projectId,
       values: {API_TOKEN: 'runtime-secret', UNUSED_TOKEN: 'unused-secret'},
@@ -87,13 +103,19 @@ describe('GET /runs/jobs/current/steps/:stepId/secrets', () => {
         segments: [{kind: 'secret', store: 'local', key: 'API_TOKEN'}],
       },
     ]);
-    await setSecrets({workspaceId: run.workspaceId, values: {API_TOKEN: 'workspace-secret'}});
-    await setSecrets({
+    await secrets.setSecrets({
+      workspaceId: run.workspaceId,
+      values: {API_TOKEN: 'workspace-secret'},
+    });
+    await secrets.setSecrets({
       workspaceId: run.workspaceId,
       projectId: run.projectId,
       values: {API_TOKEN: 'project-secret'},
     });
-    await setSecrets({workspaceId: hostileWorkspaceId, values: {API_TOKEN: 'hostile-secret'}});
+    await secrets.setSecrets({
+      workspaceId: hostileWorkspaceId,
+      values: {API_TOKEN: 'hostile-secret'},
+    });
     const token = await mintActiveLeaseToken({
       jobId: job.id,
       token: {workspaceId: hostileWorkspaceId, projectId: crypto.randomUUID()},